Once upon a time (around March I think) a local sysop challenged me to
crack his friend’s password on the local high school (Monte Vista,
monte.mvhs.srvusd.k12.ca.us, running Ultrix v4.1). So I get in, get
root (sysop access), and look at the password file. Unix passwords are
scrambled with a one-way encryption method. Say your password is “fuckchop”.
It’s stored in the password file as “hdVcOLOsIcvLE”. When you login to a
unix system instead of decrypting the password it encrypts what you type
in and matches it with the stored encrypted password. So to crack passwords
you need a program such as CrackerJack that will go through a long list of
words (a password dictionary). I couldn’t crack the guy’s password so I
deleted his account and told the local sysop there never was one
(situation averted). So I make a few accounts, Bluesman gets on the system
and we start looking through people’s mail (this is where that “Chia Pet”
letter from Delirium Issue #4 came from) when suddenly a root account
(chatter) starts paging me. Here’s a log of the ntalk conversation with
“Anirvan Chatterjee” (It’s been formatted for the sake of reading):
[Connection established]
Me: May I help you?
An: chan? Elizabeth?
Me: Yes? Have we met?
An: This is Anirvan, I believe…
Me: Anirvan! How are you?
An: Oh fine…do you see me listed as “root”?
Me: Yes, why?
An: oh…I was doing some routine syadmin stuff, when I saw you logged in…
Me: 10:00pm on a friday night eh?
An: what else is there to do on a friday night?!
Me: Yeah, I guess you’re right.
An: well, i have friends online i talk to, and then tere’s other fun stuff to do…
Me: Yeah, I’m new to this, you know how that is.
An: of course… where are you coming in from? an online service? a commercial carrier? ccnet’s probab;ly
Me: Yeah, I have an account on there, why?
An: where? I mean, what’s your email address? there…
Me: Scall@ccnet.com
An: coolness… Geez….hate how those lines keep overlapping (type control-L t
Me: Yeah… say, doesn’t it bother you in the slightest I have root?
An: say what? you have root? please explain..
Me: Well, I’m going to format your winchesters. Just business, nothing personal.
An: errr…who is this?
Me: Hehe, I’m just kidding! Internet humor.
An: errr, yes. Charlie?
Me: What? This is Liz.
An: I’m sure.
Me: y0ur c0mput3r h4s b33n b0rd3d by th 3l33t3st 0f th3 3l33t!!@#$!!
An: that’s so nice to know.
Me: r3sist3nc3 iz futil3!!
An: yay. I’m so impressed.
Me: Wanna see a neat trick?
An: not really, so Charlie,
[Connection closing. Exiting]
# removeuser chatter
Enter login name for user to be removed: chatter
This is what the entry in /etc/passwd looks like:
chatter:.bplovnCwERio:337:15:Anirvan Chatterjee,CPR2,(510)837-7507,
:/u/students/chatter:/bin/csh
Is this the entry you wish to delete? y
Working …
User chatter removed.
Do you want to remove chatter’s home directory,
all subdirectories and files (y/n)? y
You should have backed up chatter’s files if you do not wish to lose them.
Are you sure that you want to remove chatter’s files (y/n)? y
Deleting /u/students/chatter
Then I kill all his processes and change the root password. Again,
situation averted. 10 minutes later he unmounts the drives.
The next morning he tells the computer lab who did it (“Acidflux, Bluesman
and Deadlocke [aka Silicon [)ragon]”… like I said, I made a few accounts
while I was on) and that we hacked in to use thier link to the Lawerence
Livermore Labs (local nuclear facility… anyone read The Cuckoo’s Egg?).
On top of that Bluesman logged in from a New York system so Anirvan starts
talking like MOD was after his ass (This was in the California Bay Area BTW).
That afternoon Anirvan gets a call from a Monte Vista freshman named
Brett Nelson posing as _me_. He says “This is Acidflux, you will recieve a
call at 9pm tonight” along w/ some veiled threats and whatnot. They
recognized his voice and kicked him out of school (I think this story has a
moral in it somewhere). A couple months later the system is back up and I
find this article on Anirvan’s Webpage (http://192.188.37.4/~anirvan):
“Beyond Wargames” by Anirvan Chatterjee (`95)
Net historians record the sudden increase in destructive net
activities after the release of Wargames (the seminal cracker-as-hero
movie, the tale of an antisocial nerdy 80s teen equipped with a modem
who stumbles onto the secrets of a corrupt military establishment (see
also, Sneakers)). Those were the days when cracker and darkside
hackers were truly dangerous only to government and corporate America.
Well, think again. While corporate network security has increased
severalfold since then, the massive growth rate of the Internet won’t
be able to extend the same degree of protection to newcomers unable to
obtain the best protection money can buy. I speak from experience,
having gone through two such cases recently, both very close to home.
Everybody probably knows about the cracker intrusion into Monte
Vista’s computer network. (You don’t? The Reader’s Digest Condensed
Book editionI was online at Monte Vista from home on a Friday night
when I saw someone else, a friend of mine, logged in too. I tried to
“talk” to her online, but she didn’t respond. So I was doing some
routine system maintenance, when I saw a strange call to talk from
someone logged in as the system operator–but I was the system
operator. Oh well, I ignored it, until my friend finally agreed to
talk to me. She seemed rather confused, didn’t understand who I was. I
tried asking her what she was planning to do this weekend. Suddenly,
she burst into a rant along the lines of “I am elite! I broke into
your system! Hahaha!” By this time, I’d realized that “she” was
somebody who had broken in under that account, and broken into the
system operator’s account. We did some online jousting, (by now I had
Charlie Hsu, speaking voice, advising me on the fax line) until I
managed to remotely shut down the Monte Vista network, but only to
find that he’d deleted my account, my email, my projects, my web
page–everything. Talk about playing the martyr for my system. (Yes,
yes, the proper authorities have been contacted, and they’re working
hard, trying to catch the evildoers.) Anyway, there’s my story. Now
you can laugh at it.)
But after all that, who to blame? The cracker, certainly, but also the
cluelessness of the newbie system administrators (including yours
truly) who just didn’t know enough to implement current and effective
security measures. That, and insecure usage habits on the part of so
many equally clueless users ignoring even the most simple warnings
about password security (a computer network is only as strong as its
weakest password). As long as the Internet keeps expanding at such
furious rates and the age, maturity, education, training, and
all-around cluefulness of the average user keeps declining, this will
keep growing as an issue.
Net.access is getting easier and easier to obtain, and security
measures from many established, otherwise clueful net.folks are being
correspondingly toned down to fit the minimal effort/maximum personal
gain philosophy of many coming online for the first time (the same
type of people who will break every point of net.courtesy to get
information, rather than checking documentation, FAQs (Frequently
Asked (and Answered) Question lists), or contacting their local system
administrator). (For example, Microsoft Bob’s password protection will
automatically let you change it if you guess incorrectly three times
in a row–even a four-year-old could get past that kind of
protection!)
I found out very recently that my Internet carrier’s security could be
easily compromised, not online, but through what crackers call “social
engineering”–by breaking in through their customer support. January
31, someone posing as the cracker who broke into Monte Vista called my
house and left me a voice message instructing me to wait for a call at
9:00 p.m. if I wanted to recover my password. I tried dialing into my
account, and found my password to be invalid–someone had changed it!
Of course, I didn’t believe that the caller was who he claimed to be
for a second–he had pronounced my name correctly. Nobody ever
pronounces my name correctly after having only seen the spelling, so I
knew it had to be someone who knew me. And who had something against
me. I listened to the message again (the idiot had done me a huge
favor by leaving a long snippet of his voice digitally recorded for me
to listen to again and again) when I realized who it was–an annoying
Monte Vistan I’d busted and kicked off the Monte Vista network a few
months ago, for some truly unsavory activities he’d gotten into, all
the system rules he’d violated. I contacted my Internet carrier’s
support staff, and hooked up with a rather clueful administrator, who
traced the breakin. I was informed that someone calling in from the
local dial-in node had accessed my account (when I had been hours away
from the nearest modem), and deleted all the files in it. Damn! Damn!
Damn!
As we retraced the cracker’s steps, we found that the [please
substitute a handful of your favorite explicit pejoratives here] had
unsuccessfully tried to access my account at 11:00 a.m. (why wasn’t he
at school during 4th period? note network knowledge has little
correlation with common sense, intelligence, or academic achievement),
then spoke to someone on the support staff between then and 1:00 p.m.,
convincing them that he was me. Then the “helpful” support staff
changed my password for “me,” as soon as the intruder was able to
pronounce my name correctly, and give them my phone number and
address. Once he had BS’ed his way past their safeguards, he then
asked them to change “his” password for him, as he had “forgotten” it.
Devious little [choose your own again], eh? Then a little before 1:00
p.m., and again at 1:40, p.m. he logged in under my account, with the
new (now changed) password. He went through all my files. Then he
deleted everything: my saved mail, my notes, my projects, my backups.
And as if that wasn’t enough, he then proceeded to browse through
through my email. By this time in the conversation with the tech
admin, I was seething. Luckily for me, the guy was able to restore
most of my files and mail from system backups made the Friday before.
So I didn’t lose too much, but that’s beside the point. I felt so
violated. Nobody should be able to go through my email and files,
reading and deleting at will, invading my privacy; there’s a world of
difference between system operators doing routine checks, and
intruders breaking in as part of some sick revenge fantasy. So I
registered several “secure” codewords with the support staff (my
mother’s maiden name, etc.) that they would have to get from anyone
calling for support under my name. And that was that.
Yes, yes, the cracker, a (now “former”?) Monte Vista student, has been
caught and arrested, for his numerous ugly computer-related crimes
(physical theft of computer equipment is a rather silly idea if you
want to stay on the good side of the law), and I have the oddest
feeling I may have seen the last of him. But it’s not the [yet another
pejorative here] himself I’m so concerned about, as much as the trend
he’s running on. Online interaction has become so easy and widespread
that it seems as if anybody with something against you could take
action against you. And the more business that we conduct online, the
more dangerous it is (I’ve purchased several items directly on the
Internet over the course of the last year, using unencrypted credit
card numbers–dangerous, I know.) From mailbombings and anonymous
flames, canceled postings, forged mail or postings, to outright
electronic intrusion, almost anything is possible. Take Kevin Mitnick,
the recently captured master cracker who infiltrated sites in the
hundreds, from the accounting records of Netcom (the nation’s largest
Internet Service Provider, and very possibly the least-liked (for its
anarchic administration and dumbed-down service)) to the Well,
arguably the coolest and most respected Service Provider in America,
the home of the Net’s “cultural elite” (synonymous with its technical
elite). News reports say his breakins weren’t “personal.” God help
anybody who pissed him off. Interestingly enough, at least three
movies about the Internet are now filming. One of these is The Net,
about someone who’s very identity is tampered with when police,
credit, and other identity records are all altered. As technically
improbable as the plot is, the concept is definitely sound (recall the
case of the vengeful phone phreaker who rerouted his parole officer’s
home phone to a (900) sex number). This stuff doesn’t just happen to
other people. Let the netizen beware. Tough times lie ahead.
An aside: Don’t let this article scare you into not getting online.
Accessing the Internet is a fabulous experience, and not akin to war
as my words might lead you to believe; it just requires some common
sense. As long as you have your wits about you, and aren’t afraid to
turn to manuals or your friendly neighborhood system administrator for
help, you’ll be OK. Interested in getting online? Do ask me, or
someone else with online experience for help. I love helping people,
but I’d much rather be able to help someone before s/he actually
commits her time and money to problematic, expensive commercial
networks.
Then I find this followup letter:
Dear Geek-meister:
Enjoyed your latest issue. A couple of philosophical and technical
notes you may wish to ponder:
(1) Re: Anirvan’s tome on Internet security, There’s a consistent
assumption that the crackers he describes in the article are male. How
did the author know? Did “he” write about hunting giraffes? Use locker
room humor (actually, I’ve heard enough qualifying material from
females during stints at MV to dispel any such assumption)? How many
readers just read along and assumed, along with the author, that the
“perp” wears pants (oops), make that Jockeys (nope) boxers? (yikes),
buttons left over right (okay, I think).
My purpose here is not to pick on AC–indeed, I think his energy,
intellectual curiosity and considerable erudition in publishing
Paradox are really laudable. I just think we should all ferret out,
consider and overcome creeping sexism wherever we find it.
Sorry if this has been more self-glorifying than informative but after
seeing Anirvan’s side of the story I had to type this up. I’m going to
go have a coke and a smile so I’m ending the story here. Watch out
for that creeping sexism.
-Acidflux